Methods and apparatus to identify media presentations by analyzing network traffic

ABSTRACT

Methods, apparatus, systems and articles of manufacture are disclosed herein to identify media presentation by analyzing network traffic. Example instructions cause a machine to generate a traffic profile to reduce a computational burden of identifying streaming media being presented on a media presentation device, the traffic profile including first network traffic data indicative of the streaming media; obtain the traffic profile and second network traffic data corresponding to the streaming media; and generate, in response to a score for the second network traffic data meeting a threshold of similarity, a network traffic analysis report identifying the streaming media being presented on the media presentation device.

RELATED APPLICATION

This patent arises from a continuation of U.S. patent application Ser.No. 16/209,897, (now U.S. Pat. No. 10,805,690) which was filed on Dec.4, 2018. U.S. patent application Ser. No. 16/209,897 is herebyincorporated by reference in its entirety. Priority to U.S. patentapplication Ser. No. 16/209,897 is hereby claimed.

FIELD OF THE DISCLOSURE

This disclosure relates generally to media monitoring, and, moreparticularly, to methods and apparatus to identify media presentationsby analyzing network traffic.

BACKGROUND

In recent years, methods of accessing media have evolved. For example,Internet media was primarily accessed via computer systems such asdesktop and laptop computers. Recently, the advent of smart devices(e.g. televisions (TVs), smartphones, and streaming devices such asRoku®, Amazon Fire™ TV Stick, Google Chromecast™, Amazon Fire TV Cube,etc.) has allowed access to Internet media in ways that were previouslyunavailable. As used herein, the term “media” includes any type ofcontent and/or advertisement delivered via any type of distributionmedium. Thus, media includes television programming or advertisements,radio programming or advertisements, movies, web sites, streaming media,etc.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of an example environment in which an examplenetwork meter monitors network traffic data and an example mediapresentation device meter monitors streaming media.

FIG. 2 is a block diagram of an example environment in which an examplenetwork meter monitors network traffic data.

FIG. 3 is a block diagram of an example implementation of the centralfacility of FIGS. 1 and/or 2.

FIG. 4 is an illustration of example traffic profile that has beengenerated from the example environment of FIG. 2.

FIG. 5 is a flowchart representative of example machine readableinstructions which may be executed to implement media presentationdevice meter of FIG. 1.

FIG. 6 is a flowchart representative of example machine readableinstructions which may be executed to implement the network meter ofFIGS. 1 and 2.

FIG. 7 is a flowchart representative of example machine readableinstructions which may be executed to implement the central facility ofFIG. 3.

FIG. 8 is a flowchart representative of example machine readableinstructions which may be executed to implement the central facility ofFIG. 7.

FIG. 9 is a flowchart representative of example machine readableinstructions which may be executed to implement the example networktraffic analyzer of FIG. 3.

FIG. 10 is a block diagram of an example processing platform structuredto execute the instructions of FIGS. 7, 8 and 9 to implement the centralfacility of FIG. 1 and/or FIG. 3.

The figures are not to scale. In general, the same reference numberswill be used throughout the drawing(s) and accompanying writtendescription to refer to the same or like parts.

DETAILED DESCRIPTION

Example methods, apparatus, and articles of manufacture disclosed hereinmonitor media presentations at media presentation devices. Such mediapresentation devices may include, for example, Internet-enabledtelevisions, personal computers, Internet-enabled mobile handsets (e.g.,a smartphone), tablet computers (e.g., an iPad®), etc. In some examples,media may be streamed to the media presentation devices from streamingdevices. Such streaming devices may include, for example, video gameconsoles (e.g., Xbox®, PlayStation®), digital media players (e.g., aRoku media player, a Slingbox®, etc.), etc. In some examples, mediamonitoring information is aggregated to determine ownership and/or usagestatistics of media presentation devices, relative rankings of usageand/or ownership of media presentation devices, types of uses of mediapresentation devices (e.g., whether a device is used for browsing theInternet, streaming media from the Internet, etc.), and/or other typesof media presentation device information.

In examples disclosed herein, monitoring information includes, but isnot limited to, media identifying information (e.g., media-identifyingmetadata, codes, signatures, watermarks, and/or other information thatmay be used to identify presented media), application usage information(e.g., an identifier of an application, a time and/or duration of use ofthe application, a rating of the application, etc.), and/oruser-identifying information (e.g., demographic information, a useridentifier, a panelist identifier, a username, etc.).

Audio watermarking is a technique used to identify media such astelevision broadcasts, radio broadcasts, advertisements (televisionand/or radio), downloaded media, streaming media, prepackaged media,etc. Existing audio watermarking techniques identify media by embeddingone or more audio codes (e.g., one or more watermarks), such as mediaidentifying information and/or an identifier that may be mapped to mediaidentifying information, into an audio and/or video component. In someexamples, the audio or video component is selected to have a signalcharacteristic sufficient to hide the watermark. As used herein, theterms “code” or “watermark” are used interchangeably and are defined tomean any identification information (e.g., an identifier) that may beinserted or embedded in the audio or video of media (e.g., a program oradvertisement) for the purpose of identifying the media or for anotherpurpose such as tuning (e.g., a packet identifying header). As usedherein “media” refers to audio and/or visual (still or moving) contentand/or advertisements. To identify watermarked media, the watermark(s)are extracted and used to access a table of reference watermarks thatare mapped to media identifying information.

Unlike media monitoring techniques based on codes and/or watermarksincluded with and/or embedded in the monitored media, fingerprint orsignature-based media monitoring techniques generally use one or moreinherent characteristics of the monitored media during a monitoring timeinterval to generate a substantially unique proxy for the media. Such aproxy is referred to as a signature or fingerprint, and can take anyform (e.g., a series of digital values, a waveform, etc.) representativeof any aspect(s) of the media signal(s)(e.g., the audio and/or videosignals forming the media presentation being monitored). A signature maybe a series of signatures collected in series over a timer interval. Agood signature is repeatable when processing the same mediapresentation, but is unique relative to other (e.g., different)presentations of other (e.g., different) media. Accordingly, the term“fingerprint” and “signature” are used interchangeably herein and aredefined herein to mean a proxy for identifying media that is generatedfrom one or more inherent characteristics of the media.

Signature-based media monitoring generally involves determining (e.g.,generating and/or collecting) signature(s) representative of a mediasignal (e.g., an audio signal and/or a video signal) output by amonitored media device and comparing the monitored signature(s) to oneor more references signatures corresponding to known (e.g., reference)media sources. Various comparison criteria, such as a cross-correlationvalue, a Hamming distance, etc., can be evaluated to determine whether amonitored signature matches a particular reference signature. When amatch between the monitored signature and one of the referencesignatures is found, the monitored media can be identified ascorresponding to the particular reference media represented by thereference signature that matched with the monitored signature. Becauseattributes, such as an identifier of the media, a presentation time, abroadcast channel, etc., are collected for the reference signature,these attributes may then be associated with the monitored media whosemonitored signature matched the reference signature. Example systems foridentifying media based on codes and/or signatures are long known andwere first disclosed in Thomas, U.S. Pat. No. 5,481,294, which is herebyincorporated by reference in its entirety.

In recent years, the use of media services (e.g. Netflix™, Hulu™, PrimeVideo™, HBO GO™, Showtime™, etc.) has moved from almost exclusively ondesktop and laptop computers to a wide variety of media presentationdevices. Currently, such media services may be accessed through manydevices including televisions, smartphones, and streaming devicesincluding Roku, Amazon Fire TV Stick, Google Chromecast, Amazon Fire TVCube, etc. As used herein, the term streaming refers to mediatransmitting directly to a streaming device and the streaming devicesending media to a media presentation device.

Typically, media monitoring services would monitor the media streamed todesktop and laptop computers by monitoring the media presentationdevices to which the media was being sent. This was fairly simplebecause there existed direct connectivity between the monitoring deviceand the media presentation devices. For example, a network metermonitored a router in a household and the media streaming through therouter. This allowed for a relatively simple method of monitoring themedia streaming to the laptop or desktop computer because the mediamonitoring service needed only monitor the network traffic data, such asthe uniform resource locator (URL) for the media being presented or theInternet Protocol (IP) address for the media presentation device towhich the media was sent. Furthermore, the network traffic data includeddata packets which were not encrypted and could be used to determine thetype of media streaming to the media presentation device.

With the advent of new methods of streaming (e.g. Roku, Amazon Fire TVStick, Google Chromecast, Amazon Fire TV Cube, etc.), such networktraffic data may not clearly represent the media that is streaming. Forexample, the network traffic data that is accessible by a network meteris generally encrypted with only a few metrics that are not encrypted.These unencrypted metrics do not accurately represent what data is beingtransferred over the network. For example, a streaming service, such asNetflix may use content delivery networks, such as Akamai® or Level 3®.In such an example, a streaming device may request media to stream to amedia presentation device. The media that is sent to the streamingdevice may not be clearly represented by unencrypted metrics of thenetwork traffic data. Because of this unclarity, the network trafficdata that is collected by the network meter cannot be used to determineif media is streaming on a media presentation device connected to thenetwork. When the streaming device receives the streaming media from anetwork device such as a router, and sends it to a media presentationdevice, it may be unclear whether the media is being presented at all.For example, a Roku stick or a Roku box may connect to the Internet andaccess media. The media is streamed from a network device (e.g. arouter) to the Roku stick or the Roku box. The Roku device iscommunicatively coupled to a media presentation device (e.g., atelevision (TV)). The Roku device then renders the media to the TV via amedia presentation port such as a High Definition Multimedia Interfaceport (HDMI port). In this example, because the streaming device (e.g.,the Roku device) receives the streaming media via a content deliverynetwork, the unencrypted network traffic data does not clearly representthe streaming media (e.g., Netflix) and cannot be used to determine ifmedia is streaming.

Alternatively, a streaming device may send media to a media presentationdevice via a wireless connection. In this case, the same issue presentsitself when trying to identify whether media is streaming based oncaptured network traffic data.

Other ways in which media may be streamed to a media presentation deviceinclude situations in which a streaming device receives media from anetwork device such as a router. In this example, the streaming devicemay be a media presentation device, such as a smart phone or a tablet.The smart phone or tablet may then send the media, which it ispresenting on itself, to an additional media presentation device such asa television, desktop computer, laptop computer, any other digitaldisplay, projector, etc. This is a process commonly referred to as“screen mirroring.” Because the media is first being streamed to thesmart phone or tablet, the streaming data representing the media beingstreamed to the additional media presentation device may not bereflective of the media itself. In this example, the media streaming tothe additional media presentation device generates a large amount ofnetwork traffic data that may be confusing to a media monitoring servicewhen attempting to identify that media is streaming. This excess networktraffic data may be characterized as “noise” that presents additionalproblems when determining whether media is streaming. The term “noise”is used herein to describe interference between network traffic datathat is not of interest and network traffic data that is of interestwhen attempting to use the network traffic data of interest.

These new methods of accessing media on media presentation devicespresent a problem for media monitoring services. Because the media issent to streaming devices via network communications that are mostlyencrypted, network meters cannot determine the streaming media withoutthe addition of a supplemental meter. Traditionally, a mediapresentation device meter is used to supplement the network meter inorder to identify the media streaming to the media presentation device.With the multiple sources of data, it is possible to identify thestreaming media being presented on the media presentation device.However, in presentation environments without supplemental meters, it isnot possible to identify the streaming media being presented on themedia presentation device.

Prior methods of identifying streaming media being presented on a mediapresentation device using a network meter required the use of multiplemeters to identify the streaming media. In situations where only anetwork meter is present, prior methods cannot determine the streamingmedia being presented on the media presentation device because thecollected network traffic data does not provide enough information toidentify the media. The collected network traffic data alone couldrepresent a number of different tasks being done on a network. Forexample, a media presentation device may be presenting streaming mediabeing streamed to it. This may be represented in the network trafficdata as URLs related to a streaming service. However, with thisinformation alone, a media monitoring service cannot distinguish whetherthe media presentation device is actually presenting streaming media.Additional media presentation devices such as smartphones, tablets, orcomputers, may be presenting the streaming media and the collectednetwork traffic data does not clearly represent which media presentationdevice is presenting the streaming media or whether the streaming mediais actually being presented rather than a process related to a streamingmedia application running the background on a media presentation device.

Examples disclosed herein include correlating first network traffic datacollected by a network meter to streaming data collected by a mediapresentation device meter; determining second network traffic data thatpertains to streaming media streaming on a streaming device, the secondnetwork traffic data based on the first network traffic data; andgenerating a traffic profile based on a relationship between the secondnetwork traffic data and the streaming media streaming on a streamingdevice.

FIG. 1 is a block diagram of an example environment 100 in which anexample network meter monitors network traffic data and an example mediapresentation device meter monitors streaming data. The exampleenvironment 100 includes an example media exposure measurement location102, an example wireless communication system 116, an example network114, and an example central facility 118. The example media exposuremeasurement location 102 includes an example network device 104, andexample network meter 106, and example media presentation device 108,and example media presentation device meter 110, and an examplestreaming device 112. The network 114 is communicatively coupled to thewireless communication system 116 and devices in the media exposuremeasurement location 102. The central facility 118 is communicativelycoupled to the network 114. The wireless communication system 116 iscommunicatively coupled to the network 114 and devices in media exposuremeasurement location 102. The wireless communication system 116 iscommunicatively coupled to devices in the media exposure measurementlocation by an example network meter communication link 120 and examplemedia presentation device meter communication link 122.

The media exposure measurement location 102 of the illustrated exampleof FIG. 1 is a panelist household. However, the media exposuremeasurement location 102 may be any other location, such as, for examplean Internet café, an office, an airport, a library, a non-panelisthousehold, etc. While in the illustrated example a single media exposuremeasurement location 102 is shown, any number and/or type(s) of mediaexposure measurement locations may be used.

The panelist household may include one or more panelists. The panelistsare users registered on panels maintained by a ratings entity (e.g., anaudience measurement company) that owns and/or operates the ratingsentity subsystem. Traditionally, audience measurement entities (alsoreferred to herein as “ratings entities”) determine demographic reachfor advertising and media programming based on registered panel members.That is, an audience measurement entity enrolls people that consent tobeing monitored into a panel. During enrollment, the audiencemeasurement entity receives demographic information from the enrollingpeople so that subsequent correlations may be made betweenadvertisement/media exposure to those panelists and differentdemographic markets.

People (e.g., households, organizations, etc.) register as panelistsvia, for example, a user interface presented on a media device (e.g.,via a website). People may be recruited as panelists in additional oralternative manners such as, for example, via a telephone interview, bycompleting an online survey, etc. Additionally or alternatively, peoplemay be contacted and/or enlisted to join a panel using any desiredmethodology (e.g., random selection, statistical selection, phonesolicitations, Internet advertisements, surveys, advertisements inshopping malls, product packaging, etc.).

Returning to the illustrated example of FIG. 1, the media exposuremeasurement location 102 includes the network device 104, the networkmeter 106, the media presentation device 108, the media presentationdevice meter 110, and the streaming device 112. The network device 104is communicatively coupled to a plurality of devices in the mediaexposure measurement location 102. For example, the network device 104is communicatively coupled to the network meter 106 and the streamingdevice 112. The example network meter 106 is communicatively coupled tothe network device 104, the media presentation device meter 110. Thenetwork meter 106 is also communicatively coupled to the wirelesscommunication system 116 by the network meter communication link 120.The media presentation device meter 110 is communicatively coupled tothe media presentation device 108 and the network meter 106. The mediapresentation device meter 110 is also communicatively coupled to thewireless communication system 116. The media presentation device meter110 is communicatively coupled to the wireless communication system 116by the example media presentation device meter communication link 122.The streaming device 112 is communicatively coupled to the mediapresentation device 108 and the network device 104. The mediapresentation device is communicatively coupled to the streaming device112 and the media presentation device meter 110.

The network device 104 of the illustrated example of FIG. 1 is a routerthat enables the media devices in the media exposure measurementlocation 102 to communicate with the network 114 (e.g., the Internet.)In some examples, the network 114 may be implemented using any suitablewired and/or wireless network(s) including, for example, one or moredata busses, one or more Local Area Networks (LANs), one or morewireless LANs, one or more cellular networks, one or more privatenetworks, one or more public networks, etc. The example network 114enables the example network device 104 to be in communication with theexample central facility 118. As used herein, the phrase “incommunication,” including variances therefore, encompasses directcommunication and/or indirect communication through one or moreintermediary components and does not require direct physical (e.g.,wired) communication and/or constant communication, but rather includesselective communication at periodic or aperiodic intervals, as well asone-time messages. In some examples, the example network device 104includes gateway functionality such as modem capabilities. In some otherexamples, the example network device 104 is implemented in two or moredevices (e.g., a router, a modem, a switch, a firewall, etc.).

The network meter 106 of the illustrated example of FIG. 1 is a devicethat monitors the network traffic data flowing through the networkdevice 104. In some examples, the network meter 106 may be a single homeunit and may have the functionality to collect network traffic datastreaming on the network device 104. The network meter 106 may also beconfigured to communicate with other devices in the media exposuremeasurement location 102 such as, for example, the media presentationdevice meter 110 and the streaming device 112. The network meter 106 mayconfigured to collect additional network traffic data related to thetype of media being streamed to the media presentation device 108 afterreceiving the notification from the media presentation device 108. Thenetwork meter 106 may also be configured to query devices in the mediaexposure measurement location 102 to determine information on activeprocesses running on the other devices in the media exposure measurementlocation 102. For example, the example network meter 106 of FIG. 1queries the streaming device 112 to determine the active applicationrunning on the streaming device 112. The example network meter 106 isconfigured to communicate with the central facility 118 via the networkdevice 104. The network meter 106 may transmit the network traffic dataand the information determined in querying the other devices in themedia exposure measurement location 102 to the central facility 118.

As used herein, the term “network traffic data” includes a variety ofmetrics of a network device and/or network traffic including InternetProtocol (IP) addresses, URLs, domain names, Multipurpose Internet MailExtension (MIME) types, bandwidth, duration of events, count of events,etc. Duration of events may refer to the amount of time that a sessionbetween a host device (e.g. a router, the network device 104) and aclient device (e.g. the streaming device 112) exists. Count of event mayrefer to the number of communications between a client device and a hostdevice to maintain the session.

The media presentation device 108 of the illustrated example of FIG. 1is a device that may receive any type of media and present the media.The media presentation device 108 may be, for example, anInternet-enabled television, a personal computer, an Internet-enabledmobile handset (e.g., a smartphone), a tablet computer (e.g., an iPad),etc. The media presentation device 108 may present media sent from thestreaming device 112 via a wired or wireless connection to the streamingdevice 112, a wired or wireless connection to a media service provider,etc. The media presentation device 108 may present the media streamingto it from the streaming device 112 with supplementary mediapresentation devices such as speakers, projectors, additional screens,etc.

The media presentation device meter 110 of the illustrated example ofFIG. 1 is a device which meters the media being presented on the mediapresentation device 108. The example media presentation device meter 110is configured to collect streaming data on the media being streamed tothe media presentation device 108. Streaming data may include, forexample, signatures, watermarks, or other metering metrics related tothe streaming media on the media presentation device 108. Additionally,the media presentation device meter 110 may be configured to generateaudio signatures and/or video signatures and/or extract audio and/orvideo watermarks from the audio and video output of the media beingpresented by the media presentation device 108. The audio output of themedia presentation device 108 may be processed to detect audio codesand/or generate audio signatures for the streaming media. The videooutput of the media presentation device 108 may be processed to generatevideo signatures of the streaming media.

In some examples, the media presentation device meter 110 of FIG. 1 mayalso be configured to detect the streaming device 112 that the media isbeing streamed from. With the collected and/or generated and/orextracted streaming data, the media presentation device meter 110 maygenerate a monitoring report including the media being streamed and theidentity of the streaming device 112 streaming the media. The mediapresentation device meter 110 may also be configured to send themonitoring report to the central facility 118 via a connection with thenetwork device 104. The media presentation device meter 110 may furtherbe configured to communicate with the network meter 106 to transmit anotification from the media presentation device meter 110 to the networkmeter 106 that may indicate the identity of the streaming device 112and/or the type of media being streamed by the streaming device 112. Thenotification from the media presentation device meter 110 to the networkmeter 106 may also indicate a variety of other metrics about either thestreaming device 112, the media presentation device 108, and/or othermedia presentation devices that may be monitored by media presentationdevice 108.

In some examples, the media presentation device meter 110 and thenetwork meter 106 may be unable to transmit information to the centralfacility 118 via the network meter. For example, a server upstream ofthe network device 104 may not provide functional routing capabilitiesto the central facility 118. In the illustrated example of FIG. 1, thenetwork meter 106 includes additional capabilities to send informationthrough the wireless communication system 116 (e.g., the cellularcommunication system) via the network meter communication link 120. Themedia presentation device meter 110 includes additional capabilities tosend information through the wireless communication system 116 via themedia presentation device meter communication link 122.

The network meter communication link 120 and the media presentationdevice meter communication link 122 of the illustrated example of FIG. 1are cellular communication links. However, any other method and/orsystem of communication may additionally or alternatively be used suchas, for example, and Ethernet connection, a Bluetooth connection, aWi-Fi connection, etc. Further, the network meter communication link 120and the media presentation device meter communication link 122 of FIG. 1implement a cellular connection via a Global System for MobileCommunications (GSM). However, any other systems and/or protocols forcommunication may be used such as, for example, Time Division MultipleAccess (TDMA), Code Division Multiple Access (CDMA), WorldwideInteroperability for Microwave Access (WiMAX), Long term Evolution(LTE), etc.

The streaming device 112 of the illustrated example of FIG. 1 is adevice that retrieves media from a service provider for presentation. Insome examples, the streaming device 112 is capable of sending theretrieved media to a media presentation device 108. The media may besent via a wired or wireless connection to the media presentation device108. In examples such as these, the streaming device 112 may includedigital media players (e.g., a Roku media player, an Amazon Fire TVStick, a Google Chromecast, Amazon Fire TV Cube, a Slingbox, etc.),video game consoles (e.g., Xbox, PlayStation), etc.

The example central facility 118 of the illustrated example of FIG. 1 isa server that collects and processes media monitoring information fromthe network meter 106 and the media presentation device meter 110 togenerate exposure metrics related to presented media. The centralfacility 118 analyzes the media monitoring information to identify, forexample, traffic profiles for streaming media, which media presentationdevices are the most owned, the most-frequently used, theleast-frequently owned, the least-frequently used, themost/least-frequently used for particular type(s) and/or genre(s) ofmedia, and/or any other media statistics or aggregate information thatmay be determined from the data. The media presentation deviceinformation may also be correlated or processed with factors such asgeodemographic data (e.g., a geographic location of the media exposuremeasurement location, age(s) of the panelist(s) associated with themedia exposure measurement location 102, an income level of a panelist,etc.) Media presentation device information may be useful tomanufacturers and/or advertisers to determine which features should beimproved, determine which features are popular among users, identifygeodemographic trends with respect to media presentation devices,identify market opportunities, and/or otherwise evaluate their ownand/or their competitors' products.

In the illustrated example of FIG. 1, the central facility 118 mayreceive and/or obtain Internet messages (e.g., a HyperText TransferProtocol (HTTP) request(s)) that include the metering information.Additionally or alternatively, any other method(s) to receive and/orobtain metering information may be used such as, for example, an HTTPSecure protocol (HTTPS), a file transfer protocol (FTP), a secure filetransfer protocol (SFTP), etc.

In the illustrated example of FIG. 1, a panelist in the media exposuremeasurement location 102 may access media via the streaming device 112.The streaming device 112 connects to the network 114 (e.g. the Internet)via the network device 104 and streams media to the media presentationdevice 108. The media presentation device 108 presents the media, forexample, the media presentation device 108 presents the media on adisplay as well as supplemental media presentation devices (e.g.speakers).

The media presentation device meter 110 of FIG. 1 monitors the mediapresentation device 108 and may collect streaming data such as, forexample, watermarks and/or codes and/or signatures for the visual andaudio media presented on the media presentation device 108. For example,the media presentation device meter 110 may generate audio signaturesand/or video signatures and/or extract audio and/or video watermarksfrom the audio and video output of the media being presented by themedia presentation device 108. The audio output of the mediapresentation device 108 may be processed to detect audio codes and/orgenerate audio signatures for the streaming media. The video output ofthe media presentation device 108 may be processed to generate videosignatures of the streaming media. Additionally, the media presentationdevice meter 110 may be configured to detect the streaming device 112that the media is being streamed from as well as the type of media beingstreamed by the streaming device 112 and notify the network meter 106.

The media presentation device meter may also generate a monitoringreport based on the collected data that includes the media beingstreamed and the identity of the streaming device 112 streaming themedia. The media presentation device meter 110 may also be configured tosend the monitoring report to the central facility 118 via a connectionwith the network device 104. If communication with the central facility118 is obstructed via the network 114, the media presentation devicemeter 110 may also send the monitoring report to the central facility118 via the media presentation device meter communication link 122. Themedia presentation device meter 110 may have the functionality to storethe collected streaming data and/or the monitoring reports beforetransmitting the information to the central facility 118.

The network meter 106 may be configured so that upon receiving thenotification from the media presentation device meter 110, the networkmeter 106 may collect network traffic data. The network meter 106 mayadditionally identify, from the notification from the media presentationdevice meter 110, the type of media streaming to the media presentationdevice 108. After identifying the type of media, the network meter 106may collect additional network traffic data related to the type of mediabeing streamed to the media presentation device 108. Additionally, thenetwork meter may identify, from the notification from the mediapresentation device 108, the identity of the streaming device 112. Afteridentifying the streaming device 112, the network meter 106 may querythe streaming device 112 to determine the active application running onthe streaming device 112. After collecting the network traffic data anddetermining the active application on the streaming device 112 may storethe network traffic data, the identity of the streaming device 112, anidentifier for the active application on the streaming device 112, etc.,before transmitting the information to the central facility 118 over thenetwork 114 via the network device 104. If communication with thecentral facility 118 is obstructed via the network 114, the networkmeter 106 may also send the information to the central facility 118 viathe network meter communication link 120.

After receiving, at the central facility 118, the streaming data and/ormonitoring report from the media presentation device meter 110 and thenetwork traffic data and/or the identifier for the active application onthe streaming device 112 and/or the identity of the streaming device 112from the network meter 106, the central facility 118 may combine thestreaming data and the network traffic data to generate a trafficprofile that is representative of the streaming media being presented onthe media presentation device 108.

FIG. 2 is a block diagram of an example environment 200 in which anexample network meter 106 monitors network traffic data. The exampleenvironment 200 includes an example media exposure measurement location202, an example network 114, an example wireless communication system116, and an example central facility 118. The media exposure measurementlocation 202 includes an example network device 104, an example networkmeter 106, an example media presentation device 108, and an examplestreaming device 112.

The devices in the media exposure measurement location 202 of FIG. 2operate in a similar manner as the devices in the media exposuremeasurement location 102 of FIG. 1. However, in the media exposuremeasurement location 202 of FIG. 2, the media presentation device meter110 is absent. The absence of the media presentation device meter 110changes the functional capabilities of monitoring media in the mediaexposure measurement location 202. Without the media presentation devicemeter 110, the central facility 118 cannot readily determine the mediastreaming from the streaming device 112 to the media presentation device108. The loss of functionality comes from the fact that the networktraffic data that is captured by the network meter 106 is encrypted and,thus, the payloads of the network traffic cannot be examined todetermine that the traffic contains media being sent to streaming device112.

The streaming device 112 of the illustrated example of FIG. 2 is adevice that retrieves media from a service provider for presentation. Insome examples, the streaming device 112 is capable of sending theretrieved media to a media presentation device 108. The media may besent via a wired or wireless connection to the media presentation device108. In examples such as these, the streaming device 112 may includedigital media players (e.g., a Roku media player, an Amazon Fire TVStick, a Google Chromecast, Amazon Fire TV Cube, a Slingbox, etc.),video game consoles (e.g., Xbox, PlayStation), etc.

In the illustrated example of FIG. 2, the central facility 118 mayutilize the traffic profiles generated from at least one media exposuremeasurement location 102 of FIG. 1 to determine the media being streamedto the media presentation device 108 of the media exposure measurementlocation 202 of FIG. 2. With the advent of a traffic profile for media,the central facility may compare the network traffic data captured bythe network meter 106 of FIG. 2 with the traffic profile and determinewhether the pertinent network traffic data is present in the capturednetwork traffic data to determine whether the media is being presentedby the media presentation device 108.

FIG. 3 is a block diagram of an example implementation of the centralfacility 118 of FIGS. 1 and/or 2. The central facility 118 of FIG. 3includes an example network interface 302, an example notificationextractor 304, an example media device identifier 306, an exampletraffic profiler 308, an example media monitoring database 316, and anexample network traffic analyzer 318. The traffic profiler 308 includesan example data correlator 310, an example network traffic data filter312, and an example profile generator 314. The example network interface302 is coupled to networks that are exterior to the central facility 118such as the network 114 of FIGS. 1 and/or 2. The example networkinterface 302 is coupled to the network traffic analyzer 318 as well asthe notification extractor 304. The example notification extractor 304is coupled to the media device identifier 306. The example media deviceidentifier 306 is coupled to the traffic profiler 308. The exampletraffic profiler 308 is coupled to the media monitoring database 316 andthe example media monitoring database 316 is coupled to the networktraffic analyzer 318.

The network interface 302 of the illustrated example of FIG. 3 is adevice that connects another device (e.g., the central facility 118) toa network (e.g., the network 114). The network interface 302 may beimplemented as hardware or software. As a hardware the network interface302 may be electronic circuits that facilitate the communication betweena network (e.g., network 114) and the parts of a computer responsiblyfor processing the obtained network data (e.g., data from the network114). The network traffic interface 302 obtains and/or transmitsinformation to networks that are exterior to the central facility 118such as the network 114. The network interface 302 may implement a webserver to receive and/or obtain notifications including streaming dataand network traffic data from the media presentation device meter 110and the network meter 106, respectively. The notifications including thestreaming data and/or the network traffic data may be formatted as anHTTP message; however, any other message format and/or protocol mayadditionally or alternatively be used such as, for example, a filetransfer protocol (FTP), a simple message transfer protocol (SMTP), anHTTP secure (HTTPS) protocol, etc.

The notification extractor 304 of the illustrated example of FIG. 3extracts information from the notifications that are received and/orobtained by the network interface 302. In some examples, thenotification extractor 304 may extract the streaming data and thenetwork traffic data from the notifications. The notification extractor304 may also extract from the notifications the identity of thestreaming device 112 in the media exposure measurement location 102 ofFIG. 1 and/or the media exposure measurement location 202 of FIG. 2, theactive application on the streaming device 112, and other informationrelated to the network traffic data, the streaming data, or thestreaming device 112. If the notification extractor 304 extracts onlynetwork traffic data from a media exposure measurement location (e.g.,the media exposure measurement location 202), the notification extractor304 will send the network traffic data to the network traffic analyzer318 in order to be analyzed as well as the media device identifier 306in order to be processed.

The media device identifier 306 of the illustrated example of FIG. 3identifies the streaming device 112 of FIG. 2. The example media deviceidentifier 306 utilizes the extracted information from the notificationextractor 304 to identify the streaming device 112. For example, theidentity of the streaming device 112, device manufacturer information,device type information, device operating system information, and/ordevice media access control (MAC) address information may be used todetermine the identity of the streaming device 112. This information isuseful to a media monitoring service and is useful in identifyingstreaming media using the traffic profile. For example, network trafficdata that includes media that is streaming to a streaming device (e.g.,the streaming device 112) may include specific network traffic data thatis related to the particular streaming device. Knowing the identity ofthe streaming device 112 allows the example traffic profiler 308 toprofile network traffic data based on the identity of the streamingdevice 112.

The example central facility 118 of FIG. 3, includes the example trafficprofiler 308. The example traffic profiler 308 correlates networktraffic data and streaming data from the media presentation device meter110 of FIG. 1 and the network meter 106 of FIG. 1 and to generate atraffic profile of the pertinent network traffic data that is useful incharacterizing specific network traffic data as relating to apresentation of streaming.

The example traffic profiler 308 accesses traffic profiles, networktraffic data, streaming data, etc., that is stored in the example mediamonitoring databases 316 to apply additional correlation and filteringto the traffic profiles for certain streaming media. Additionally, theexample traffic profiler 308 receives/obtains network traffic data fromthe network traffic data analyzer 318 that has been identified as notfitting any of the current traffic profiles of record. The trafficprofiler 308 generates a number of robust traffic profiles for a numberof streaming media that allow the network traffic analyzer 318 to moreaccurately analyze information that the central facility 118 receivesand/or obtains.

The example traffic profiler 308 includes the data correlator 310. Thedata correlator 310 associates the network traffic data with the examplestreaming data obtained from the media presentation device meter 110 ofFIG. 1. For example, streaming data may include audio and/or visualwatermarks and/or signatures and/or codes of the streaming media withtimestamps for when the media started streaming and when the mediastopped streaming. In the example, the data correlator 310 associatesthe entries in the network traffic data with the timestamps in thestreaming data. In the example, the data correlator 310 then associatestwo network traffic data entries with the start time and stop time ofthe streaming media. The data correlator 310 associates network trafficdata entries with the timestamps in the streaming data by ordering thestreaming data according to the timestamps of the streaming data andordering the network traffic data according to the timestamps in thenetwork traffic data. The data correlator 310 then established universaltimestamps that corresponds to both the timestamps for the networktraffic data and the timestamps for the streaming data. The universaltimestamps are based off of the timestamps from the network traffic dataand the timestamps from the streaming data. In the example, the datacorrelator 310 then selects the network traffic data that occurred afterthe network traffic data entry that corresponds to the start time of thestreaming media and the network traffic data entry that corresponds tothe stop time of the streaming media. This selected network traffic datais then used by the network traffic data filter 312.

The example network traffic data filter 312 filters excess networktraffic data from the selected network traffic data. For example, theremay be several events occurring on the network 114 during the start timeand stop time of the streaming media. The example network traffic datafilter 312 analyzes the selected network traffic data and determines thenetwork traffic data entries that are related to the streaming media andthe network traffic data entries that are not. The example networktraffic data filter 312 determines which network traffic data entriesare related to the streaming media based on the streaming data collectedby the media presentation device meter 110 of FIG. 1. For example,network traffic data entries that are related to the streaming mediainclude IP addresses, URLs, domain names, MIME types, bandwidth,duration of events, count of events that are representative of thestreaming media. For example, if the streaming media is Netflix, anexample of a network traffic data entry related to Netflix is a networktraffic data entry with a duration of events that is 300 milliseconds, acount of events that is 30,000, and an example URL that isalami.ntflx.com. A network traffic data entry that is related to Netflixis a network traffic data entry with a duration of events that is 4milliseconds, a count of events that is 60, and an example URL that iswww.google.com. The example network traffic data filter 312 removes thenetwork traffic data entries that are not related to the streaming mediafrom the selected network traffic data. After removing the networktraffic data entries that are not related to the streaming media fromthe selected network traffic data, the filtered selected network trafficdata is used by the example profile generator 314 to generate a trafficprofile that is representative of the streaming media.

The example profile generator 314 generates a traffic profile based onthe filtered selected network traffic data. The profile generator 314determines a relationship between the filtered selected network trafficdata and the streaming media. The relationship may be a number ofpertinent network traffic data entries that occur when a streamingdevice 112 is streaming media to a media presentation device 108. Theprofile generator 314 may additionally be configured to combine a numberof profiles in the media monitoring database 316 to form a morecomprehensive set of pertinent network traffic data that occurs when astreaming device 112 is streaming media to a media presentation device108.

In the illustrated example of FIG. 3, the central facility 118 includesthe media monitoring database 316 to record data (e.g., trafficprofiles, network traffic data, streaming data, etc.). In theillustrated example, the example media monitoring database 316 storesdata (e.g., traffic profiles, network traffic data, streaming data,etc.) used to identify media being presented on media presentationdevices 108. In some examples, the media monitoring database 316additionally stores user identifying information and/or demographicssuch that received and/or obtained device identification informationand/or media information can be translated into demographic information.The media monitoring database 316 may be implemented by a volatilememory (e.g., a Synchronous Dynamic Random Access Memory (SDRAM),Dynamic Random Access Memory (DRAM), RAMBUS Dynamic Random Access Memory(RDRAM), etc.) and/or a non-volatile memory (e.g., flash memory). Themedia monitoring database 316 may additionally or alternatively beimplemented by one or more double data rate (DDR) memories, such as DDR,DDR2, DDR3, mobile DDR (mDDR), etc. The media monitoring database 316may additionally or alternatively be implemented by one or more massstorage devices such as hard disk drive(s), compact disk drive(s)digital versatile disk drive(s), etc. While in the illustrated examplemedia monitoring database 316 is illustrated as a single database, themedia monitoring database 316 may be implemented by any number and/ortype(s) of databases. Furthermore, the data stored in the mediamonitoring database 316 may be in any data format such as, for example,binary data, comma delimited data, tab delimited data, structured querylanguage (SQL) structures, etc.

In the illustrated example of FIG. 3, the example media monitoringdatabase 316 stores data as, for example, flash memory, magnetic media,optical media, etc. Furthermore, the data stored in the media monitoringdatabase 316 may be in any data format such as, for example, binarydata, comma delimited data, tab delimited data, structured querylanguage (SQL) structures, etc. In the illustrated example, the examplemedia monitoring database 316 stores metadata (e.g., codes, signatures,etc.) used to identify media. In some examples, the media monitoringdatabase 316 additionally stores user identifying information and/ordemographics such that received and/or obtained user identifiers can betranslated into demographic information.

The example central facility 118 includes the network traffic analyzer318 to generate and/or prepare media measurement reports for the networktraffic data that the central facility 118 obtains and/or receives. Thenetwork traffic analyzer 318 prepares media measurement reportsindicative of the exposure of media on media presentation devices. Insome examples, the network traffic analyzer 318 generates a reportidentifying demographics associated with the media via the receivedand/or obtained network traffic data, streaming data, and othernotification information. For example, a network meter 106 at the mediaexposure measurement location 202 may collect network traffic data. Thenetwork traffic analyzer 318 may prepare a report associating thenetwork traffic data with streaming media based on the traffic profilessaved in the media monitoring database 316. In some instances, thenetwork traffic analyzer 318 generates a report identifying the type ofstreaming media being presented on the media presentation device 108.For example, the network traffic analyzer 318 prepares a reportassociating the obtained network traffic data with the saved trafficprofiles. For example, the network traffic analyzer 318 associates thenetwork traffic data with a media services (e.g. Netflix, Hulu, AmazonPrime Video, HBO GO, Showtime, Starz, etc.).

For example, the network traffic analyzer 318 obtains and/or receivesnetwork traffic data from the notification extractor 304. In theexample, the network traffic analyzer 318 obtains and/or receivestraffic profiles from the media monitoring database 316. The examplenetwork traffic analyzer 318 compares the network traffic data to thetraffic profiles and generates a score for each traffic profile thatindicates the level of similarity between the network traffic data andeach traffic profile. The example network traffic data analyzer 318ranks the scores from highest to lowest. In other examples, the networktraffic analyzer 318 ranks the scores according to other parameters. Ifthe highest score meets a threshold level of similarity, the networktraffic data is categorized as relating to the traffic profile thatcorresponds to the highest score. However, if the highest score does notmeet the threshold level of similarity the network traffic analyzer willre-analyze the network traffic data with new, different, trafficprofiles. If the highest score fails to meet the threshold value ofsimilarity more than a predetermined number of times, the networktraffic data is sent to the traffic profiler 308 to be profiled into anew traffic profile. A score is determined to have met the thresholdlevel of similarity when the score is within a predetermined distance ofthe threshold level of similarity.

The example network traffic analyzer 318 generates a report based on theanalysis. The network traffic analyzer 318 may present the report on adisplay, webpage, and/or application interface. By presenting the reportgenerated by the network traffic analyzer 318, a media monitoringservice may use the report to determine how the way in which media isstreamed, the frequency of streaming data, and/or other metrics that thenetwork analyzer 318 may include in reports relates to the effectivenessof a media party's media, an advertiser's advertisement, etc.

FIG. 4 is an illustration of an example traffic profile 400 generated bythe example traffic profiler 308 of FIG. 3. The example traffic profile400 is a preliminary traffic profile for streaming media (e.g. Netflixstreaming media) that is generated from the example media exposuremeasurement location 102. In the illustrated example, the trafficprofile 400 includes an example network traffic data entry 402, anexample media presentation device meter entry 404, an example networktraffic data entry 406, and an example network traffic data entry 408.Because the traffic profile 400 was generated from a single mediaexposure measurement location (e.g. media exposure measurement location102), there may not be enough information to determine the networktraffic data entries that are related to the streaming media and thenetwork traffic data entries that are not. For example, the examplenetwork traffic data entry 402 does not relate to the streaming media.The network traffic data entry 402 includes a duration of 4milliseconds, a count of 60 communications, and a URL of www.google.com.The network traffic data entry 402 is not related to the streaming mediabecause the duration, the count, and the URL do not meet a set ofcriteria that is known to relate to the streaming media. For example, aduration the meets the set of known criteria may be a duration that istypically associated with the streaming media. An example duration thatis associated with Netflix streaming media, may be, for example, 300milliseconds. Additionally, an example count that is associated withNetflix streaming media is a count of 28,000. Furthermore, an exampleURL that is associated with Netflix streaming media is a URL ofakami.ntflx.com. Network traffic data entries that are associated with(e.g. related to) a particular type of streaming media are not limitedto the examples disclosed herein. Network traffic data entries that arerelated to a particular type of streaming media may be changed over timeto maintain relevance to a particular type of streaming media as thestreaming media changes over time.

In the illustrated example of FIG. 4, the traffic profile 400 includesthe example media presentation device meter entry 404. The example mediapresentation device meter entry 404 includes an identity of a streamingdevice 112 of the media exposure measurement location 102. The mediapresentation device meter entry 404 may further include streaming datarepresentative of the streaming media.

The example traffic profile 400 includes the example network trafficdata entry 406 which is a network traffic data entry representative ofthe network meter 106 querying devices in the media exposure measurementlocation 102. For example, the network meter 106 queries the streamingdevice 112 and discover that the active application is, for example, theNetflix application. This is useful in the network traffic data becauseit allows the traffic profiler 308 to determine if the activeapplication corresponds to the captured streaming data. If the activeapplication corresponds to the captured streaming data, the trafficprofiler 308 can, for example, utilize the network traffic data filter312 to filter the network traffic data entries that are not related tothe streaming media (e.g. the active application).

The example traffic profile 400 includes the example network trafficdata entry 408. The example network traffic data entry 408 includes aduration of 300, a count of 28,000, and a URL of akami.ntflx.com. Thenetwork traffic data entry 408 is an example of a network traffic dataentry that is related to the streaming media.

In the illustrated examples, the network traffic data filter 312 usesthe traffic profile 400 and additional traffic profiles to filter outexcess network traffic data entries that are not related to thestreaming media (e.g. network traffic data entry 402). By filtering outexcess network traffic data entries, the traffic profiler 308 generatesmore refined traffic profiles that are representative of the streamingmedia. Additionally, the traffic profiler 308, may utilize supervisedmachine learning techniques to compare multiple traffic profiles from avariety of media exposure measurement locations to identify the networktraffic data entries that are representative of a particular type ofstreaming media and to filter out excess network traffic data entries.The traffic profiler 308 may also use supervised machine learningtechniques to combine traffic profiles that are related to differenttypes of streaming media to develop new traffic profiles that arerepresentative of a combination of streaming media.

While an example manner of implementing the central facility 118 ofFIGS. 1 and/or 2 is illustrated in FIG. 3, one or more of the elements,processes and/or devices illustrated in FIG. 3 may be combined, divided,re-arranged, omitted, eliminated and/or implemented in any other way.Further, the example data correlator 310, the example network trafficdata filter 312, the example profile generator 314, the traffic profiler308 and/or, more generally, the example central facility of FIGS. 1and/or 2 may be implemented by hardware, software, firmware and/or anycombination of hardware, software and/or firmware. Thus, for example,any of the example data correlator 310, the example network traffic datafilter 312, the profile generator 314, the traffic profiler 308 and/or,more generally, the example central facility 118 could be implemented byone or more analog or digital circuit(s), logic circuits, programmableprocessor(s), programmable controller(s), graphics processing unit(s)(GPU(s)), digital signal processor(s) (DSP(s)), application specificintegrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s))and/or field programmable logic device(s) (FPLD(s)). When reading any ofthe apparatus or system claims of this patent to cover a purely softwareand/or firmware implementation, at least one of the example datacorrelator 310, the example network traffic data filter 312, the profilegenerator 314, and/or the example traffic profiler 308 is/are herebyexpressly defined to include a non-transitory computer readable storagedevice or storage disk such as a memory, a digital versatile disk (DVD),a compact disk (CD), a Blu-ray disk, etc. including the software and/orfirmware. Further still, the example central facility 118 of FIGS. 1and/or 2 may include one or more elements, processes and/or devices inaddition to, or instead of, those illustrated in FIG. 3, and/or mayinclude more than one of any or all of the illustrated elements,processes and devices. As used herein, the phrase “in communication,”including variations thereof, encompasses direct communication and/orindirect communication through one or more intermediary components, anddoes not require direct physical (e.g., wired) communication and/orconstant communication, but rather additionally includes selectivecommunication at periodic intervals, scheduled intervals, aperiodicintervals, and/or one-time events.

A flowchart representative of example hardware logic, machine readableinstructions, hardware implemented state machines, and/or anycombination thereof for implementing the media presentation device meter110 of FIGS. 1 and/or 2 is shown in FIG. 5. The machine readableinstructions may be an executable program or portion of an executableprogram for execution by a computer processor. The program may beembodied in software stored on a non-transitory computer readablestorage medium such as a CD-ROM, a floppy disk, a hard drive, a DVD, aBlu-ray disk, or a memory associated with the processor, but the entireprogram and/or parts thereof could alternatively be executed by a deviceother than the processor and/or embodied in firmware or dedicatedhardware. Further, although the example program is described withreference to the flowchart illustrated in FIG. 5, many other methods ofimplementing the example media presentation device meter 110 mayalternatively be used. For example, the order of execution of the blocksmay be changed, and/or some of the blocks described may be changed,eliminated, or combined. Additionally or alternatively, any or all ofthe blocks may be implemented by one or more hardware circuits (e.g.,discrete and/or integrated analog and/or digital circuitry, an FPGA, anASIC, a comparator, an operational-amplifier (op-amp), a logic circuit,etc.) structured to perform the corresponding operation withoutexecuting software or firmware.

FIG. 5 is a flowchart representative of example machine readableinstructions which may be executed to implement the example mediapresentation device meter 110 of FIG. 1. The program of FIG. 5 begins atblock 502 where the media presentation device 110 detects a streamingdevice streaming media to the media presentation device 108. The program500 continues at block 504 where the media presentation device meter 110collects streaming data based on the streaming media. The streaming dataincludes, for example, signatures, watermarks, or other metering metricsrelated to the streaming media on the media presentation device 108.Additionally, at block 504, the media presentation device meter 110generates audio signatures and/or video signatures and/or extract audioand/or video watermarks from the audio and video output of the mediabeing presented by the media presentation device 108. The audio outputof the media presentation device 108 is processed to detect audio codesand/or generate audio signatures for the streaming media. The videooutput of the media presentation device 108 is processed to generatevideo signatures of the streaming media.

In the illustrated example of FIG. 5, the program 500 continues at block506 where the media presentation device meter 110 notifies the networkmeter 106 of an identity of a streaming device (e.g., the identity ofthe streaming device 112). Next in the program 500, at block 508, themedia presentation device meter 110 transmits a notification to thecentral facility 118. The notification may include the collectedstreaming data as well as the identity of the streaming device 112. Inthe illustrated example, the media presentation device meter 110 isconfigured to transmit the notification to the central facility 118 viathe media presentation device meter communication link 122, andadditionally via the network device 104. Because of the capability ofmultiple modes of communication, the media presentation device meter 110may transmit the collected streaming data to the central facility 118when there are obstructions to network communication via the network114.

At block 510, the media presentation device meter 110 determines whetherto continue monitoring the media presentation device 108 andcommunicating with the network meter 106 and the central facility 118.If the media presentation device meter 110 determines that it willcontinue monitoring the media presentation device 108 and communicatingwith the network meter 106 and the central facility 118 the program 500proceeds to block 502. However, if the media presentation device meter110 determines that it will not continue monitoring the mediapresentation device 108 and communicating with the network meter 106 andthe central facility 118, the program 500 ends at block 512.

A flowchart representative of example hardware logic, machine readableinstructions, hardware implemented state machines, and/or anycombination thereof for implementing the network meter 106 of FIGS. 1and/or 2 is shown in FIG. 6. The machine readable instructions may be anexecutable program or portion of an executable program for execution bya computer processor. The program may be embodied in software stored ona non-transitory computer readable storage medium such as a CD-ROM, afloppy disk, a hard drive, a DVD, a Blu-ray disk, or a memory associatedwith the processor, but the entire program and/or parts thereof couldalternatively be executed by a device other than the processor and/orembodied in firmware or dedicated hardware. Further, although theexample program is described with reference to the flowchart illustratedin FIG. 6, many other methods of implementing the example network meter106 may alternatively be used. For example, the order of execution ofthe blocks may be changed, and/or some of the blocks described may bechanged, eliminated, or combined. Additionally or alternatively, any orall of the blocks may be implemented by one or more hardware circuits(e.g., discrete and/or integrated analog and/or digital circuitry, anFPGA, an ASIC, a comparator, an operational-amplifier (op-amp), a logiccircuit, etc.) structured to perform the corresponding operation withoutexecuting software or firmware.

FIG. 6 is a flowchart representative of example machine readableinstructions which may be executed to implement the network meter ofFIGS. 1 and 2. The program 600 of FIG. 6 begins at block 602 where theexample network meter 106 collects network traffic data. The networktraffic data includes, for example, IP addresses, URLs, domain names,MIME types, bandwidth, duration of events, count of events, etc.

The program 600 continues at block 604 where the network meter 106monitors a network (e.g. the network 114) for a notification of anidentity of a streaming device (e.g. streaming device 112). If thenotification is not received and/or obtained, the program 600 continuesto block 602. However, if the notification is received and/or obtained,the program 600 continues to block 606 where the network meter 106initiates a device discovery process. The example device discoveryprocess of block 606 causes the network meter 106 to query devices inthe media exposure measurement location 102 to determine information onactive processes running on the other devices in the media exposuremeasurement location 102. For example, the network meter 106 queries thestreaming device 112 to determine the active application running on thestreaming device 112.

Next, the program 600 of the illustrated example of FIG. 6 continues toblock 608 where the network meter 106 transmits the collected networktraffic data to the central facility 118. In the illustrated example,the network meter 106 is configured to transmit the collected networktraffic data to the central facility 118 via the network metercommunication link 120, and additionally via the network device 104.Because of the capability of multiple modes of communication, thenetwork meter 106 may transmit the collected network traffic data to thecentral facility 118 when there are obstructions to networkcommunication via the network 114. After the network meter 106 transmitsthe network traffic data to the central facility 118, the program 600continues to block 610.

At block 610, the network meter 106 determines whether to continuemonitoring the network device 104 and communicating with the mediapresentation device meter 110 and the central facility 118. If thenetwork meter 106 determines that it will continue monitoring thenetwork device 104 and communicating with the media presentation devicemeter 110 and the central facility 118 the program 600 proceeds to block602. However, if the network meter 106 determines that it will notcontinue monitoring the network device 104 and communicating with themedia presentation device meter 110 and the central facility 118, theprogram 600 ends at block 612.

Flowcharts representative of example hardware logic, machine readableinstructions, hardware implemented state machines, and/or anycombination thereof for implementing the central facility 118 of FIGS.1, 2, and/or 3 are shown in FIGS. 7, 8, and 9. The machine readableinstructions may be an executable program or portion of an executableprogram for execution by a computer processor such as the processor 1012shown in the example processor platform 1000 discussed below inconnection with FIG. 10. The program may be embodied in software storedon a non-transitory computer readable storage medium such as a CD-ROM, afloppy disk, a hard drive, a DVD, a Blu-ray disk, or a memory associatedwith the processor 1012, but the entire program and/or parts thereofcould alternatively be executed by a device other than the processor1012 and/or embodied in firmware or dedicated hardware. Further,although the example program is described with reference to theflowchart illustrated in FIGS. 7, 8, and 9, many other methods ofimplementing the example central facility 118 may alternatively be used.For example, the order of execution of the blocks may be changed, and/orsome of the blocks described may be changed, eliminated, or combined.Additionally or alternatively, any or all of the blocks may beimplemented by one or more hardware circuits (e.g., discrete and/orintegrated analog and/or digital circuitry, an FPGA, an ASIC, acomparator, an operational-amplifier (op-amp), a logic circuit, etc.)structured to perform the corresponding operation without executingsoftware or firmware.

FIG. 7 is a flowchart representative of example machine readableinstructions which may be executed to implement the traffic profiler 308of FIG. 3. The program 700 begins at block 702 where the trafficprofiler 308 utilizes the data correlator 310 to correlate the collectednetwork traffic data and the captured streaming data. The datacorrelator 310 correlates the network traffic data and the streamingdata by associating the network traffic data with the duration of thestreaming media that is included in the streaming data. For example, thestreaming data includes timestamps at each entry of streaming data. Thedata correlator 310 may determine the start time and stop time of aparticular streaming media. Additionally, the network data includes, forexample, timestamps at each network traffic data entry. The datacorrelator 310 associates the network data with timestamps between thestart time and stop time of the streaming media as specified by thestreaming data.

The program 700 continues to block 704 where the network traffic datafilter 312 determines the network traffic data that is relevant to thestreaming media. For example, the network traffic data filter 312filters excess network traffic data that does not relate to thestreaming data. Next, the program 700 continues at block 706 where theprofile generator 314 generates a traffic profile. The traffic profileis, for example, the traffic profile 400 of FIG. 4. The example profilegenerator 314 generates the traffic profile 400 based on a relationshipbetween the relevant network traffic data and the streaming media. Therelationship between the relevant network traffic data and the streamingmedia is based on the correlation between pertinent network traffic dataand the streaming media. In other words, the example traffic profile 400is based on a relationship between the network traffic data that isrelevant and pertinent to the streaming media. The relationship isdefined so that the network data that is categorized as pertinent to thestreaming media may be used to determine whether other network trafficdata from a different media exposure measurement location (e.g. mediaexposure measurement location 202) corresponds to a particular type ofstreaming data.

Next, the program 700 continues to block 708 where the traffic profiler308 determines whether to continue the program or not. If the program isto continue, the program 700 continues to block 502 of the program 500of FIG. 5. If, however, the program is to stop, the program 700continues to block 710 where it ends.

FIG. 8 is a flowchart representative of example machine readableinstructions which may be executed to implement block 704 of FIG. 7. Theprogram begins at block 802 where the example network traffic datafilter 312 determines whether the network traffic data from the mediaexposure measurement location 102 relates to the streaming media fromthe media exposure measurement location 102. The network traffic datafilter 312 compares the network traffic data entries with the streamingdata. The network traffic filter 312 determines whether each particularnetwork traffic data entry relates to the streaming media by comparingthe information in the network traffic data entries to the informationfrom the streaming data such as watermarks, signatures, etc. If thenetwork traffic data filter 312 determines that a network traffic dataentry is not related to the streaming media, the network traffic datafilter 312 marks or otherwise denotes the particular network trafficdata entry as not related to the streaming media and proceeds to analyzethe next network traffic data entry. If, however, the network trafficdata filter 312 determines that the network traffic data entry doesrelate to the streaming media, the network traffic data filter 312 marksor otherwise denotes the particular network traffic data entry asrelated to the streaming media and proceeds to block 804.

At block 804, the example network traffic data filter 312 determineswhether all the network traffic data entries have been analyzed. If thenetwork traffic data filter 312 determines that all the network trafficdata entries have not been analyzed, the network traffic data filter 312proceeds to block 802, otherwise, the network traffic data filter 312proceeds to block 806.

At block 806, the example network traffic data filter 312 removes thenetwork traffic data entries that do not relate to the streaming mediafrom the selected network traffic data. The network traffic data entriesthat are removed may be compared to other network traffic data fromdifferent media exposure measurement location to quickly identifynetwork traffic data entries that are not related to the streaming mediaat the media exposure measurement location. At block 808, the networktraffic data filter 312 returns to the program 700 and continues toblock 706.

FIG. 9 is a flowchart representative of example machine readableinstructions which may be executed to implement the example networktraffic analyzer 318 of FIG. 3. The program 900 begins at block 902where the example network traffic analyzer 318 obtains network trafficdata from the notification extractor 304. At block 904, the examplenetwork traffic analyzer 318 obtains traffic profiles from the mediamonitoring database 316.

At block 906, the example network traffic analyzer 318 compares thenetwork traffic data to the data profiles. At block 908 the examplenetwork traffic analyzer 318 generates a score for each traffic profilethat corresponds to the similarity between the network traffic data andthe traffic profile. At block 910 the example network traffic analyzer318 ranks the scores.

At block 912, the example network traffic analyzer 318 determines if thehighest ranked score meets a threshold value for similarity. If thehighest ranked score does not meet the threshold value for similarity,the example network traffic analyzer 318 determines, at block 920, ifthe network traffic data being analyzed has had the highest ranked scorenot meet the threshold value of similarity before. If the highest rankedscore has not met the threshold value of similarity before, the networktraffic analyzer 312 proceeds to block 902. However, if the highestranked score has met the threshold value of similarity before, theexample network traffic analyzer 318 transmits, at block 922, thenetwork traffic data to the traffic profiler 308 for further analysis.The network traffic analyzer 318 proceeds to block 916.

Returning to block 912, if the network traffic analyzer 318 determinesthat the highest ranked score meets the threshold value of similarity,the example network traffic analyzer 318 generates, at block 914, anetwork traffic analysis report identifying the type of streaming mediabeing presented on the media presentation device 108. For example, thenetwork traffic analyzer 318 prepares a report associating the obtainednetwork traffic data with the saved traffic profiles. For example, thenetwork traffic analyzer 318 associates the network traffic data with amedia services (e.g. Netflix, Hulu, Amazon Prime Video, HBO GO,Showtime, Starz, etc.).

The network traffic analyzer 318 may present the report on a display,webpage, and/or application interface. By presenting the reportgenerated by the network traffic analyzer 318, a media monitoringservice may use the report to determine how the way in which media isstreamed, the frequency of streaming data, and/or other metrics that thenetwork analyzer 318 may include in reports relates to the effectivenessof a media party's media, an advertiser's advertisement, etc.

The example network traffic analyzer 318 determines, at block 916,whether to continue the program 900. If the network traffic analyzer 318determines to continue the program 900, the network traffic analyzer 318proceeds to block 902. If, however, the network traffic analyzer 318determines not to continue the program 900, the network traffic analyzer318 proceeds to block 918 where the program 900 ends. As mentionedabove, the example processes of FIGS. 5, 6, 7, 8, and 9 may beimplemented using executable instructions (e.g., computer and/or machinereadable instructions) stored on a non-transitory computer and/ormachine readable medium such as a hard disk drive, a flash memory, aread-only memory, a compact disk, a digital versatile disk, a cache, arandom-access memory and/or any other storage device or storage disk inwhich information is stored for any duration (e.g., for extended timeperiods, permanently, for brief instances, for temporarily buffering,and/or for caching of the information). As used herein, the termnon-transitory computer readable medium is expressly defined to includeany type of computer readable storage device and/or storage disk and toexclude propagating signals and to exclude transmission media.

“Including” and “comprising” (and all forms and tenses thereof) are usedherein to be open ended terms. Thus, whenever a claim employs any formof “include” or “comprise” (e.g., comprises, includes, comprising,including, having, etc.) as a preamble or within a claim recitation ofany kind, it is to be understood that additional elements, terms, etc.may be present without falling outside the scope of the correspondingclaim or recitation. As used herein, when the phrase “at least” is usedas the transition term in, for example, a preamble of a claim, it isopen-ended in the same manner as the term “comprising” and “including”are open ended. The term “and/or” when used, for example, in a form suchas A, B, and/or C refers to any combination or subset of A, B, C such as(1) A alone, (2) B alone, (3) C alone, (4) A with B, (5) A with C, (6) Bwith C, and (7) A with B and with C. As used herein in the context ofdescribing structures, components, items, objects and/or things, thephrase “at least one of A and B” is intended to refer to implementationsincluding any of (1) at least one A, (2) at least one B, and (3) atleast one of A and at least one of B. Similarly, as used herein in thecontext of describing structures, components, items, objects and/orthings, the phrase “at least one of A or B” is intended to refer toimplementations including any of (1) at least one A, (2) at least one B,and (3) at least one A and at least one B. As used herein in the contextof describing the performance or execution of processes, instructions,actions, activities and/or steps, the phrase “at least one of A and B”is intended to refer to implementations including any of (1) at least A,(2) at least B, and (3) at least A and at least B. Similarly, as usedherein in the context of describing the performance or execution ofprocesses, instructions, actions, activities and/or steps, the phrase“at least one of A or B” is intended to refer to implementationsincluding any of (1) at least A, (2) at least B, and (3) at least A andat least B.

FIG. 10 is a block diagram of an example processor platform 1000structured to execute the instructions of FIGS. 7, 8, and 9 to implementthe apparatus of FIG. 3. The processor platform 1000 can be, forexample, a server, a personal computer, a workstation, a self-learningmachine (e.g., a neural network), a mobile device (e.g., a cell phone, asmart phone, a tablet such as an iPad), a personal digital assistant(PDA), an Internet appliance, a DVD player, a CD player, a digital videorecorder, a Blu-ray player, a gaming console, a personal video recorder,a set top box, a headset or other wearable device, or any other type ofcomputing device.

The processor platform 1000 of the illustrated example includes aprocessor 1012. The processor 1012 of the illustrated example ishardware. For example, the processor 1012 can be implemented by one ormore integrated circuits, logic circuits, microprocessors, GPUs, DSPs,or controllers from any desired family or manufacturer. The hardwareprocessor may be a semiconductor based (e.g., silicon based) device. Inthis example, the processor implements the notification extractor 304,the media device identifier 306, the traffic profiler 308, the networktraffic analyzer 318 of FIG. 3.

The processor 1012 of the illustrated example includes a local memory1013 (e.g., a cache). The processor 1012 of the illustrated example isin communication with a main memory including a volatile memory 1014 anda non-volatile memory 1016 via a bus 1018. The volatile memory 1014 maybe implemented by Synchronous Dynamic Random Access Memory (SDRAM),Dynamic Random Access Memory (DRAM), RAMBUS® Dynamic Random AccessMemory (RDRAM®) and/or any other type of random access memory device.The non-volatile memory 1016 may be implemented by flash memory and/orany other desired type of memory device. Access to the main memory 1014,1016 is controlled by a memory controller.

The processor platform 1000 of the illustrated example also includes aninterface circuit 1020. The interface circuit 1020 may be implemented byany type of interface standard, such as an Ethernet interface, auniversal serial bus (USB), a Bluetooth® interface, a near fieldcommunication (NFC) interface, and/or a PCI express interface. In thisexample, the interface 1020 includes the network interface 302 of FIG.3.

In the illustrated example, one or more input devices 1022 are connectedto the interface circuit 1020. The input device(s) 1022 permit(s) a userto enter data and/or commands into the processor 1012. The inputdevice(s) can be implemented by, for example, an audio sensor, amicrophone, a camera (still or video), a keyboard, a button, a mouse, atouchscreen, a track-pad, a trackball, isopoint and/or a voicerecognition system.

One or more output devices 1024 are also connected to the interfacecircuit 1020 of the illustrated example. The output devices 1024 can beimplemented, for example, by display devices (e.g., a light emittingdiode (LED), an organic light emitting diode (OLED), a liquid crystaldisplay (LCD), a cathode ray tube display (CRT), an in-place switching(IPS) display, a touchscreen, etc.), a tactile output device, a printerand/or speaker. The interface circuit 1020 of the illustrated example,thus, typically includes a graphics driver card, a graphics driver chipand/or a graphics driver processor.

The interface circuit 1020 of the illustrated example also includes acommunication device such as a transmitter, a receiver, a transceiver, amodem, a residential gateway, a wireless access point, and/or a networkinterface to facilitate exchange of data with external machines (e.g.,computing devices of any kind) via a network 1026. The communication canbe via, for example, an Ethernet connection, a digital subscriber line(DSL) connection, a telephone line connection, a coaxial cable system, asatellite system, a line-of-site wireless system, a cellular telephonesystem, etc.

The processor platform 1000 of the illustrated example also includes oneor more mass storage devices 1028 for storing software and/or data.Examples of such mass storage devices 1028 include floppy disk drives,hard drive disks, compact disk drives, Blu-ray disk drives, redundantarray of independent disks (RAID) systems, and digital versatile disk(DVD) drives. In the illustrated example of FIG. 10 the mass storagedevice 1028 includes one or more media monitoring databases 316.

The machine executable instructions 1032 of FIG. 7 may be stored in themass storage device 1028, in the volatile memory 1014, in thenon-volatile memory 1016, and/or on a removable non-transitory computerreadable storage medium such as a CD or DVD.

From the foregoing, it will be appreciated that example methods,apparatus and articles of manufacture have been disclosed that generatetraffic profiles that may be used to identify streaming media beingpresented on a media presentation device when only a network meter isavailable. Traffic profiles include network traffic data entries thatrelate to a particular type of streaming media being presented on amedia presentation device. Example methods, apparatus, and articles ofmanufacture disclosed herein allow for a media monitoring service tocombine multiple traffic profiles to generate more refined trafficprofiles according to particular media. Generating a more refinedtraffic profile according to particular media allows for mediamonitoring services to identify media streaming to a media presentationdevice in environments with only network metering. The disclosedmethods, apparatus and articles of manufacture improve the efficiency ofusing a computing device by generating a traffic profile that reducesthe computational intensity of determining a particular type of media byproviding a traffic profile to which collected network traffic data canbe compared to identify a particular media being presented on a mediapresentation device. Without a traffic profile to which collectednetwork traffic data can be compared, a computer must process streamingdata and analyze the collected network traffic data in view of thestreaming data in order to determine the particular media beingpresented on a media presentation device. Furthermore, the disclosedmethods, apparatus, and articles of manufacture disclosed hereineliminate the need for media presentation device meters to determineparticular media being presented on a media presentation device. Inother words, the disclosed methods, apparatus, and articles ofmanufacture disclosed herein reduce the computational and processingburden of media presentation device meters by eliminating the need formedia presentation device meters. The disclosed methods, apparatus andarticles of manufacture are accordingly directed to one or moreimprovement(s) in the functioning of a computer.

Although certain example methods, apparatus and articles of manufacturehave been disclosed herein, the scope of coverage of this patent is notlimited thereto. On the contrary, this patent covers all methods,apparatus and articles of manufacture fairly falling within the scope ofthe claims of this patent.

What is claimed is:
 1. An apparatus comprising: a data correlator tocorrelate first network traffic data collected by a network meter tostreaming data collected by a media presentation device meter; a networktraffic data filter to determine second network traffic data thatpertains to streaming media streaming on a streaming device, the secondnetwork traffic data based on the first network traffic data; and aprofile generator to generate a traffic profile based on a relationshipbetween the second network traffic data and the streaming mediastreaming on the streaming device to reduce a computational burden ofidentifying the streaming media, the traffic profile including networktraffic data entries indicative of the streaming media.
 2. The apparatusof claim 1, wherein the data correlator is to: obtain the first networktraffic data via a network interface; and obtain a notificationincluding at least an identity of the streaming device and the streamingdata.
 3. The apparatus of claim 1, wherein, the first network trafficdata includes at least one of domain names, IP addresses, URLs, MIMEtypes, bandwidth, duration of events, and count of events.
 4. Theapparatus of claim 1, wherein, the data correlator is to correlate thefirst network traffic data to the streaming data by associating thefirst network traffic data to a duration of the streaming media.
 5. Theapparatus of claim 1, wherein, the network traffic data filter is tofilter out excess network traffic data from the first network trafficdata that is not related to the streaming device or the streaming mediato determine the second network traffic data.
 6. The apparatus of claim1, wherein, the relationship between the second network traffic data andthe streaming media is based on correlating pertinent network trafficdata to the streaming media.
 7. The apparatus of claim 6, wherein, theprofile generator is to use the traffic profile and additional trafficprofiles to modify the relationship between the second network trafficdata and the streaming media to refine the pertinent network trafficdata for the streaming media.
 8. An apparatus comprising: a trafficprofiler to generate a traffic profile to reduce a computational burdenof identifying streaming media being presented on a media presentationdevice, the traffic profile including first network traffic dataindicative of the streaming media; and a network traffic analyzer to:obtain the traffic profile and second network traffic data correspondingto the streaming media; and generate, in response to a score for thesecond network traffic data meeting a threshold of similarity, a networktraffic analysis report identifying the streaming media being presentedon the media presentation device.
 9. The apparatus of claim 8, whereinthe traffic profiler is to generate the traffic profile based on arelationship between the streaming media and the first network trafficdata, the first network traffic data filtered from third network trafficdata including excess network traffic data that does not pertain to thestreaming media.
 10. The apparatus of claim 8, wherein the score for thesecond network traffic data corresponds to similarity between the secondnetwork traffic data and the traffic profile, and the network trafficanalyzer is to: generate the score for the second network traffic dataand additional scores for the second network traffic data, theadditional scores corresponding to similarities between the secondnetwork traffic data and additional traffic profiles, respectively; rankthe score and the additional scores; and in response to a highest one ofthe ranked scores meeting the threshold of similarity, generate thenetwork traffic analysis report.
 11. The apparatus of claim 10, whereinthe network traffic analyzer is to, in response to determining that thehighest one of the ranked scores does not meet the threshold ofsimilarity, determine whether the highest one of the ranked scores hasnot met the threshold of similarity before.
 12. The apparatus of claim10, wherein the network traffic analyzer is to: in response todetermining that the highest one of the ranked scores has not met thethreshold of similarity before, obtain additional traffic profiles froma media monitoring database; and in response to determining that thehighest one of the ranked scores has met the threshold of similaritybefore, transmit the second network traffic data to the traffic profilerfor further analysis.
 13. The apparatus of claim 8, wherein the networktraffic analyzer is to present the network traffic analysis report on atleast one of a display, webpage, or application interface.
 14. Theapparatus of claim 8, wherein the network traffic analysis reportassociates the second network traffic data with a media servicesproviding the streaming media.
 15. A non-transitory computer-readablestorage medium comprising instructions that, when executed, cause amachine to at least: generate a traffic profile to reduce acomputational burden of identifying streaming media being presented on amedia presentation device, the traffic profile including first networktraffic data indicative of the streaming media; obtain the trafficprofile and second network traffic data corresponding to the streamingmedia; and generate, in response to a score for the second networktraffic data meeting a threshold of similarity, a network trafficanalysis report identifying the streaming media being presented on themedia presentation device.
 16. The computer-readable storage medium ofclaim 15, wherein the instructions cause the machine to generate thetraffic profile based on a relationship between the streaming media andthe first network traffic data, the first network traffic data filteredfrom third network traffic data including excess network traffic datathat does not pertain to the streaming media.
 17. The computer-readablestorage medium of claim 16, wherein the instructions cause the machineto: obtain the third network traffic data; and obtain a notificationincluding at least an identity of a streaming device streaming thestreaming media and streaming data representing the streaming media. 18.The computer-readable storage medium of claim 17, wherein theinstructions cause the machine to correlate the third network trafficdata to the streaming data by associating the first network traffic datato a duration of the streaming media.
 19. The computer-readable storagemedium of claim 17, wherein the instructions cause the machine to filterout the excess network traffic data from the third network traffic datathat is not related to the streaming device or the streaming media todetermine the first network traffic data.
 20. The computer-readablestorage medium of claim 16, wherein the relationship between the firstnetwork traffic data and the streaming media is based on correlatingpertinent network traffic data to the streaming media.
 21. Thecomputer-readable storage medium of claim 16, wherein the instructionscause the machine to use the traffic profile and additional trafficprofiles to modify the relationship between the first network trafficdata and the streaming media to refine pertinent network traffic datafor the streaming media.
 22. The computer-readable storage medium ofclaim 15, wherein the score for the second network traffic datacorresponds to similarity between the second network traffic data andthe traffic profile, and the instructions cause the machine to: generatethe score for the second network traffic data and additional scores forthe second network traffic data, the additional scores corresponding tosimilarities between the second network traffic data and additionaltraffic profiles, respectively; rank the score and the additionalscores; and in response to a highest one of the ranked scores meetingthe threshold of similarity, generate the network traffic analysisreport.
 23. The computer-readable storage medium of claim 22, whereinthe instructions cause the machine to, in response to determining thatthe highest one of the ranked scores does not meet the threshold ofsimilarity, determine whether the highest one of the ranked scores hasnot met the threshold of similarity before.
 24. The computer-readablestorage medium of claim 22, wherein the instructions cause the machineto: in response to determining that the highest one of the ranked scoreshas not met the threshold of similarity before, obtain additionaltraffic profiles from a media monitoring database; and in response todetermining that the highest one of the ranked scores has met thethreshold of similarity before, transmit the second network traffic datafor further analysis.
 25. The computer-readable storage medium of claim15, wherein the instructions cause the machine to present the networktraffic analysis report on at least one of a display, webpage, orapplication interface.
 26. The computer-readable storage medium of claim15, wherein the network traffic analysis report associates the secondnetwork traffic data with a media services providing the streamingmedia.
 27. The computer-readable storage medium of claim 15, wherein atleast one of the first network traffic data or the second networktraffic data includes at least one of domain names, IP addresses, URLs,MIME types, bandwidth, duration of events, and count of events.
 28. Amethod comprising: generating a traffic profile to reduce acomputational burden of identifying streaming media being presented on amedia presentation device, the traffic profile including first networktraffic data indicative of the streaming media; obtaining the trafficprofile and second network traffic data corresponding to the streamingmedia; and generating, in response to a score for the second networktraffic data meeting a threshold of similarity, a network trafficanalysis report identifying the streaming media being presented on themedia presentation device.
 29. The method of claim 28, further includinggenerating the traffic profile based on a relationship between thestreaming media and the first network traffic data, the first networktraffic data filtered from third network traffic data including excessnetwork traffic data that does not pertain to the streaming media. 30.The method of claim 28, wherein the score for the second network trafficdata corresponds to similarity between the second network traffic dataand the traffic profile, and the method further includes: generating thescore for the second network traffic data and additional scores for thesecond network traffic data, the additional scores corresponding tosimilarities between the second network traffic data and additionaltraffic profiles, respectively; ranking the score and the additionalscores; and in response to a highest one of the ranked scores meetingthe threshold of similarity, generating the network traffic analysisreport.
 31. The method of claim 30, further including, in response todetermining that the highest one of the ranked scores does not meet thethreshold of similarity, determining whether the highest one of theranked scores has not met the threshold of similarity before.
 32. Themethod of claim 30, further including: in response to determining thatthe highest one of the ranked scores has not met the threshold ofsimilarity before, obtaining additional traffic profiles from a mediamonitoring database; and in response to determining that the highest oneof the ranked scores has met the threshold of similarity before,transmitting the second network traffic data for further analysis. 33.The method of claim 28, further including presenting the network trafficanalysis report on at least one of a display, webpage, or applicationinterface.
 34. The method of claim 28, wherein the network trafficanalysis report associates the second network traffic data with a mediaservices providing the streaming media.
 35. An apparatus comprising:memory; instructions in the memory; and at least one processor toexecute the instructions to: correlate first network traffic datacollected by a network meter to streaming data collected by a mediapresentation device meter; determine second network traffic data thatpertains to streaming media streaming on a streaming device, the secondnetwork traffic data based on the first network traffic data; andgenerate a traffic profile based on a relationship between the secondnetwork traffic data and the streaming media streaming on the streamingdevice to reduce a computational burden of identifying the streamingmedia, the traffic profile including network traffic data entriesindicative of the streaming media.
 36. The apparatus of claim 35,wherein, the at least one processor is to correlate the first networktraffic data to the streaming data by associating the first networktraffic data to a duration of the streaming media.
 37. An apparatuscomprising: memory; instructions in the memory; and at least oneprocessor to execute the instructions to: generate a traffic profile toreduce a computational burden of identifying streaming media beingpresented on a media presentation device, the traffic profile includingfirst network traffic data indicative of the streaming media; obtain thetraffic profile and second network traffic data corresponding to thestreaming media; and generate, in response to a score for the secondnetwork traffic data meeting a threshold of similarity, a networktraffic analysis report identifying the streaming media being presentedon the media presentation device.
 38. The apparatus of claim 37, whereinthe score for the second network traffic data corresponds to similaritybetween the second network traffic data and the traffic profile, and theat least one processor is to: generate the score for the second networktraffic data and additional scores for the second network traffic data,the additional scores corresponding to similarities between the secondnetwork traffic data and additional traffic profiles, respectively; rankthe score and the additional scores; and in response to a highest one ofthe ranked scores meeting the threshold of similarity, generate thenetwork traffic analysis report.